PT-2023-25523 · Unknown+1 · Disintegration Imaging+1
Pic4Xiu
·
Publicado
2023-09-04
·
Atualizado
2024-08-02
·
CVE-2023-36308
CVSS v3.1
5.5
Média
| Vetor | AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Disintegration Imaging version 1.6.2
Description
The issue allows attackers to cause a panic due to an integer index out of range during a Grayscale call via a crafted TIFF file to the
scan function of scanner.go. It is unclear whether there are common use cases in which this panic could have any security consequence. Parsing a corrupt or malicious image with invalid color indices can also cause a panic.Recommendations
For Disintegration Imaging version 1.6.2, as a temporary workaround, consider disabling the
Grayscale call or restricting the use of the scan function in scanner.go until a patch is available. Avoid using the scan function with crafted TIFF files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.Exploit
Correção
Improper Validation of Array Index
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Debian
Disintegration Imaging